BuddyPress.org

@iameverywhere

I have thought about this a lot as well. BuddyPress spam is SO obvious for a human to figure out. You can detect spammers with almost perfect accuracy in just a few seconds. They all do the same thing. They create an account, then post garbage links. If you have Groups enabled, they create groups full of links in the description. I don’t know of a plugin that will do this, but the best way to block BP spam I think would be to put users in moderation if they post links to groups or activity, just like the setting we have for blog post comments.

https://buddypress.org/support/search/spam/
https://codex.wordpress.org/Hardening_WordPress

Awesome, I didn’t know about NinjaFirewall until now.

Change your “Admin” username to something dificult

Yes, this is very important. Not to stop spammers as much as to stop your site from getting hacked. Brute force hacking is infinitely harder if they have to guess the username AND password correctly at the SAME time. Just about impossible. If they know the username is “admin” they only have to guess the password, which is actually possible if they hammer your site all day.

Not sure why it’s not working.

For alternative spam plugins/solutions, there’s another more active thread going on here:
https://buddypress.org/support/topic/stop-buddypress-spam/

Two more methods that help. I recently had a crazy spam attack – probably 300 fake signups per day. I implemented these two methods and it dropped to near 0.

1. Change the /register/ slug to something unique. An example would be /create-your-account/, or something of that nature. It just needs to be unique and also make sense in a URL for your user. Spammers targeting BuddyPress look for /register/ as the signup page. It’s all automated so you want to filter them out at the first step.

2. Add this to your functions.php file in your theme or child theme.

It presents a dummy field that humans don’t see. Spambots will fill it out, and if the field captures a value it will reject the signup.

// BuddyPress Honeypot
function add_honeypot() {
    echo '';
}
add_action('bp_after_signup_profile_fields','add_honeypot');
function check_honeypot() {
    if (!empty($_POST['system55'])) {
        global $bp;
        wp_redirect(home_url());
        exit;
    }
}
add_filter('bp_core_validate_user_signup','check_honeypot');

Credits for #2 go to:
http://mattts.net/development-stuff/web-development-stuff/wordpress/buddypress/anti-spam-techniques/registration-honeypot/

I edited it slightly to remove the required redirect. Add that back from his tutorial if you want to. It requires that you make an extra page to send the spammer to, and I personally think that’s not necessary. I actually want them to have no indication their signup failed.

Currently the plugin “good question” is helping me with reducing spam signups more than any other.

I used to rely on si-captcha to help with this, but it started having some issues a few months ago (on my multi-site / BP sites), so that is not in use on my sites any longer.

as buddyboss mentioned above, “bp-registration options” was a good choice for a while, it worked pretty well for me around v 1.5 or 1.6 I think.. but then issues started occurring and it was left without updates for a long time (while the plugin dev was running for an election or something if my memory is serving me today), so axed that one…

Nothing is going to stop the manual spammers, but they are easy to eradicate once you have stopped all the bot signups with one of the QnA type plugins in my humble experience anyhow.

5-10 is OK — When I was handling a job application site every month we received 4000-5000 applicants and and had about 75-200 “bad users” we did have people entering bad email for their job application but it was also sometime the applicant mistype their email AND ending up shooting registration confirmation to the wrong/closed/nonexistent email at Gmail/Yahoo/Hotmail etc (I had to deal with those email providers 1-2 times a year to make sure that my Mail Server is not on the blacklist).

Btw on the Stop Spammers setting add the StopSpamForum API that way it easier for you to check or submit bad user (add Honeypot & Botscout if possible). Also “Check Spam Words” on the setting and add to them if you see a bad username keep popping up with different IPs.

pls remove spam comment above and delete spam account @saeed-mahmoood

thanks

I have used Bad Behavior. It’s ok.

I found the best solution so far has been BuddyPress Security Check.
https://wordpress.org/plugins/bp-security-check/

It knocked out the majority of spam for me, and I’ve tested many spam plugins. You’ll still get some spammers, but hopefully less.

Most spammers leave links in forums. BuddyPress could really use a method to block new users who post links pending approval.

This plugin puts users in moderation on signup:
https://wordpress.org/plugins/bp-registration-options/

But that still requires you to manually activate everyone…

What anti-spam plugins are you running and how many spam registration do you average per day?

I’m currently running akismet, pixel jar honeypot, si captcha, and stop spammer by keith graham and I get 3-5 spam registration per day.

Has anyone tried Bad Behavior? How does that work for spam registration?

Akismet is a good plugin to have enabled. It’s free for personal websites and is completely unobtrusive:

https://wordpress.org/plugins/akismet/

But think of your fight against spam as a ‘strategy’. No single plugin will do the job. You’ll probably need to deploy a combo of plugin(s), manual moderation etc. Spammers are always changing their tactics so your strategy will need to change from time to time also.

How about using the following plugins:

1. Stop Spammers by Keith Graham
2. Captcha by BestWebSoft.

FYI: I have no relation with the plugin creators

NOTE: Just make sure you also have access to the FTP in case you you are locked out from the admin. Since I do not know what other plugins you have on your site — Some plugins are not compatible with others (e.g I used different CAPTCHA plugin and it locked me out). If you are locked out from the admin just use the ftp to DELETE or RENAME THE plugin folders to disable THE “bad plugins”

Although I haven’t used it myself, I’ve read good reviews:

SI CAPTCHA Anti-Spam
https://wordpress.org/plugins/si-captcha-for-wordpress/

Rick, glad that we’re clearing up some confusion. To confirm, yes, messaging is totally different than posts. Please read the codex links provided. Also, if you really want to take buddypress for a test drive, set up a development site either on a live site or right on your own computer using http://www.instantwp.com/ and then add some “fake” users and messages, and data using this plugin: https://wordpress.org/plugins/bp-default-data/

And then jump in there and click around like crazy, edit, message, post, and see what happens! this is the best way to really check things out without doing any damage to your own site. Nothing compares to getting your hands dirty and mucking about (in a safe test environment).

This way you can really understand what messaging is, what private messaging is, broadcasting from admin to all members, etc. You can also add/remove plugins and check out their functionality, all in the comfort of your own computer’s hard drive or a test environment set up at a test domain/host that you control/own.

Also, keep in mind that buddypress has many features but you do not have to enable them! for example, there is a feature for groups. But you don’t have to enable it! you can add a forum (using bbPress) but you don’t have to! you can have private messaging so members can send private messages to each other… but, you guessed it, you don’t have to enable this feature. Also, another powerful feature is that you can give members of your site the ability to start their own blogs! this is called “multisite” but you can choose to enable this or not. Same goes for “friend connections” feature… etc.

My suggestion is to start with a very simple starting point and then as your community grows, add features that they require or need. It is a far too common mistake for new buddypress users to just turn everything on at the start.

If you don’t want to restrict your membership in any way or to collect money online from them then you don’t need anything else other than buddypress and wordpress. But look through the membership plugin links I provided to familiarize yourself with them and their features just in case. A few are completely free and still have tonnes of features.

Finally, keep in mind that spam registrations do happen. There are many guides and tools to mitigate spam membership registrations. Here’s a good start:

Preventing Spammer Registration

Google is your friend for more info on spam fighting.

definitely spam

I normally install a couple of plugins to deal with spammers and idiots.
Wordfence and Better WP Security

I’d agree with steps 1 to 3! With reference to 4, you could try installing a capcha plugin. It’s always better to stop spammers at the front door as opposed to trying to deal with them when they’re inside your house!

5. What else should be done at this stage?

Celebrate! 🙂